Crypto ETFs solve a genuine problem for investors. They provide price exposure through brokerage accounts without requiring buyers to secure private keys. However, that convenience has created a less visible risk: billions of dollars in Bitcoin now depend on a small group of custodians.
The blockchain remains decentralized, but the investment infrastructure built around it does not. When several competing funds rely on the same provider, one failure can affect multiple products. Crypto ETF custody has therefore become a market-level concern, not merely a security issue for individual funds.
Fund filings reveal overlapping dependencies
An analysis of regulatory filings shows how much value can sit behind a limited number of custody arrangements.
| Fund | Disclosed custodian | Reported value |
| iShares Bitcoin Trust | Coinbase Custody, with Anchorage available as an additional custodian | $67.4 billion in net assets at December 31, 2025 |
| Fidelity Wise Origin Bitcoin Fund | Fidelity Digital Asset Services | $21.7 billion in Bitcoin at June 30, 2025 |
| Bitwise Bitcoin ETF | Coinbase Custody | $4.3 billion in Bitcoin at June 30, 2025 |
Sources: iShares Bitcoin Trust 2025 annual filing, Fidelity Wise Origin Bitcoin Fund quarterly filing, and Bitwise Bitcoin ETF quarterly filing.
The reporting dates differ, so these figures do not represent current custody market shares. They still demonstrate the scale of assets dependent on individual providers.
Coinbase Custody serves several otherwise competing products. Fidelity uses an affiliated custodian, which provides some industry-level diversity but keeps custody within the same corporate group. These arrangements may be secure individually while leaving the wider market exposed to correlated service-provider risk.
Segregated wallets do not remove operational risk
Fund sponsors use cold storage and segregated wallets to protect ETF holdings. These controls reduce online attack exposure and separate a trust’s assets from those belonging to the custodian or other customers.
They do not make the system failure-proof.
The Invesco Galaxy Bitcoin ETF annual filing warns that compromised private keys, inadequate controls or service failures could disrupt operations. Such problems could prevent the trust from creating or redeeming shares and, in severe circumstances, force it to liquidate.
The main danger is therefore not limited to theft. A regulatory restriction, software failure, internal error, insolvency proceeding or communications outage could temporarily block asset transfers. When one provider serves several funds, the disruption can reach them simultaneously.
Investors could then face wider deviations between share prices and net asset value, impaired creations or redemptions, and reduced market confidence. The Bitcoin network might continue operating normally while the financial products built on top of it struggle to function.
Backup custody must work in practice
Naming another custodian in a contract does not automatically create resilience. The backup provider must be ready to receive assets, authenticate instructions and support fund activity during market stress.
BlackRock’s 2025 filing identifies Anchorage Digital Bank as an additional available custodian. The same filing states that the sponsor had no current plans to move the trust’s Bitcoin there. This provides an alternative, but it raises a practical question about how quickly the backup could assume responsibility during a disruption.
Issuers should disclose the percentage of assets held by each provider, the time needed to activate backup custody and the results of transfer tests. Regulators should also run market-wide stress scenarios involving several products that use the same company.
Mandatory diversification may not suit every fund. Transferring assets or changing key-management arrangements creates its own security and coordination risks. Standardized disclosure, tested contingency plans and board-approved concentration limits would provide a stronger starting point.
Custody resilience must catch up with ETF growth
Crypto ETFs have widened access to digital assets, but they have also concentrated operational control within a small custody market. Cold storage protects individual holdings, yet it cannot prevent one provider’s failure from disrupting several funds.
Investors and regulators should track three measures: each custodian’s share of total ETF assets, the percentage protected by an active backup arrangement, and the tested recovery time for creations and redemptions. If assets keep growing while these figures remain concentrated or undisclosed, the industry is increasing systemic risk faster than it is building resilience. Crypto ETFs should not depend on safeguards that exist only in contracts and have never been tested under pressure